The

booting In computing, booting is the process of starting a computer as initiated via Computer hardware, hardware such as a button or by a software command. After it is switched on, a computer's central processing unit (CPU) has no software in its ma ...

process of

Microsoft Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for ...

varies between different releases.

DOS-based Windows

Windows 1.x/2.x

In Windows versions 1.01 to Windows 2.11, the system was loaded when WIN.COM was executed. It then loaded WIN100.BIN or WIN200.BIN and WIN100.OVL or WIN200.OVL, along with the configuration settings file

WIN.INI 
WIN.INI is a basic  INI file that was used in versions of the Microsoft Windows operating environment up to Windows 3.11 to store basic settings at boot time. By default, all font, communications drivers, wallpaper, screen saver, and language setti ...

. The default shell is the

MS-DOS Executive The Windows shell is the graphical user interface for the Microsoft Windows operating system. Its readily identifiable elements consist of the desktop, the taskbar, the Start menu, the task switcher and the AutoPlay feature. On some versions of W ...

. The modules GDI.EXE, KERNEL.EXE and USER.EXE, fonts, and the various device drivers (such as COMM.DRV, MOUSE.DRV, KEYBOARD.DRV) are incorporated in WIN100.BIN/WIN200.BIN and WIN100.OVL/WIN200.OVL.

Windows 3.x/9x

Windows 3.x Windows 3.x means either of, or all of the following versions of Microsoft Windows: * Windows 3.0 * Windows 3.1x Windows NT * Windows NT 3.x Windows NT 3.x may refer to either of, or all of the following versions of Microsoft Windows: * Windows ...

and 95/98/ME, the boot loader phase is handled by

MS-DOS MS-DOS ( ; acronym for Microsoft Disk Operating System, also known as Microsoft DOS) is an operating system for x86-based personal computers mostly developed by Microsoft. Collectively, MS-DOS, its rebranding as IBM PC DOS, and a few o ...

. During the boot phase, CONFIG.SYS and

AUTOEXEC.BAT 


AUTOEXEC.BAT is a system file that was originally on DOS-type operating systems. It is a plain-text batch file in the root directory of the boot device. The name of the file is an abbreviation of "automatic execution", which describes its functio ...

are executed, along with the configuration settings files

WIN.INI 
WIN.INI is a basic  INI file that was used in versions of the Microsoft Windows operating environment up to Windows 3.11 to store basic settings at boot time. By default, all font, communications drivers, wallpaper, screen saver, and language setti ...

and SYSTEM.INI. Virtual device drivers are also loaded in the startup process: they are most commonly loaded from the registry (HKLM\System\CurrentControlSet\Services\VxD) or from the SYSTEM.INI file. When all system configuration files and device drivers have been loaded, the 16-bit modules, KRNL386.EXE, GDI.EXE, and USER.EXE, are loaded, then the 32-bit DLLs (KERNEL32.DLL, GDI32.DLL, and USER32.DLL) are loaded. The 32-bit VxD message server (MSGSRV32) starts MPREXE.EXE, which is responsible for loading the network logon client (such as Client for Microsoft Networks, Microsoft Family Logon or Windows Logon). When a user is logging on to Windows, the startup sound is played, the shell (usually EXPLORER.EXE) is loaded from the

oot ''The Legend of Zelda: Ocarina of Time'' is an action-adventure game developed and published by Nintendo for the Nintendo 64. It was released in Japan and North America in November 1998, and in PAL regions the following month. ''Ocarina of Tim ...

section of the SYSTEM.INI file, and startup items are loaded. In all versions of Windows 9x except ME, it is also possible to load Windows by booting to a DOS prompt and typing "win". There are some command line switches that can be used with the WIN command: with the /D switch, Windows boots to safe mode, and with the /D:n switch, Windows boots to safe mode with networking. The latter switch only works properly with Windows 95. In Windows 3.1, additional options are available, such as /3, which starts Windows in 386 enhanced mode, and /S, which starts Windows in standard mode A startup sound was first added in Windows 3.0 after installing the Multimedia Extensions (MME), but not enabled by default until Windows 3.1.

Windows NT before Vista

Windows NT Windows NT is a proprietary graphical operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems sc ...

, the boot loader is called

NTLDR NTLDR (abbreviation of ''NT loader'') is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it was replaced by the BOO ...

. It is responsible for accessing the file system on the boot drive, for starting

ntoskrnl.exe ntoskrnl.exe (short for Windows NT operating system kernel executable), also known as the kernel image, contains the kernel and executive layers of the Microsoft Windows NT kernel, and is responsible for hardware abstraction, process handling, an ...

and for loading boot-time device drivers into memory. Once all the Boot and System drivers have been loaded, the kernel (system thread) starts the Session Manager Subsystem (smss.exe), which in turn starts

winlogon In computing, Winlogon (Windows Logon) is the component of Microsoft Windows operating systems that is responsible for handling the secure attention sequence, loading the user profile on logon, and optionally locking the computer when a screens ...

, which loads the

graphical identification and authentication The graphical identification and authentication (GINA) is a component of Windows NT 3.51, Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003 that provides secure authentication and interactive Logging (computer security), logon servic ...

library. After a user has successfully logged into the machine, winlogon does the following: * User and Computer

Group Policy Group Policy is a feature of the Microsoft Windows NT family of operating systems (including Windows 7, Windows 8.1, Windows 10, Windows 11, and Windows Server 2003+) that controls the working environment of user accounts and computer accounts. G ...

settings are applied. * Startup programs are run from the following locations: *#HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce *#HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *#HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *#HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run *#HKCU\Software\Microsoft\Windows\CurrentVersion\Run *#HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *#''All Users ProfilePath''\Start Menu\Programs\Startup\ (this path is localized on non-English versions of Windows) *#''Current User ProfilePath''\Start Menu\Programs\Startup\ (this path is localized on non-English versions of Windows) In Windows 95/98/ME, it was also possible to run a program before the user logs on by using RunServicesOnce or RunServices keys. In Windows NT, this has been replaced by the services.exe program, which is able to load a set of system services before a user logs on. Additionally, in English-language versions of Windows, the startup folder was called "StartUp" instead of "Startup" in Win9x. Due to the minimally restricted environment of these operating systems, any program can add itself to the Startup registry key or system folder. This method is frequently used by

malware Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...

Windows NT since Vista

The sequence of booting

Windows Vista Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...

and later versions is different from any previous version of Windows that uses the

NT kernel The architecture of Windows NT, a line of operating systems produced and sold by Microsoft, is a layered design that consists of two main components, user mode and kernel mode. It is a preemptive, reentrant multitasking operating system, wh ...

. The operating system

boot loader A bootloader, also spelled as boot loader or called boot manager and bootstrap loader, is a computer program that is responsible for booting a computer. When a computer is turned off, its softwareincluding operating systems, application code, a ...

in Vista is called winload.exe, and is invoked by

Windows Boot Manager The booting process of Windows Vista and later versions differ from the startup process part of previous versions of Windows. In this article, unless otherwise specified, what is said about Windows Vista also applies to all later NT operatin ...

. Additionally, the GINA that has been in use with all versions of Windows NT since 3.1 has been entirely replaced by "Credential Providers".

References